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We present a new protocol for practical quantum cryptography, tailored for an implementation 
with weak coherent pulses. The key is obtained by a very simple time-of-arrival measurement on 
the data line; an interferometer is built on an additional monitoring line, allowing to monitor the 
presence of a spy (who would break coherence by her intervention). Against zero-error attacks (the 
analog of photon- number-splitting attacks), this protocol performs as well as standard protocols with 
strong reference pulses: the key rate decreases only as the transmission t of the quantum channel. 
We present also two attacks that introduce errors on the monitoring line: the intercept-resend, and 
a coherent attack on two subsequent pulses. Finally, we sketch several possible variations of this 
protocol. 



I. INTRODUCTION 

Quantum cryptography [1], or quantum key distribu- 
tion (QKD), is probably the most mature field in quan- 
tum information, both in theoretical and in experimen- 
tal advances. On the theoretical side, almost all QKD 
protocols have been proven to provide unconditional se- 
curity in some regime; on the practical side, QKD has al- 
ready reached the stage of commercial prototypes. Still, 
much work is needed. A big task consists in bringing 
both theory and applications in contact again: practical 
QKD systems do not fulfill all the requirements of un- 
conditional security proofs (or, if you prefer, these proofs 
are still too abstract to cope with a practical system). 
Here, we address a different question: we aim for the 
most practical QKD system. Instead of looking for a new 
implementations of known protocols, we choose to start 
from scratch by inventing a new protocol. There are two 
basic requirements: 

• The protocol must be easily implementable, say 
with the smallest number of standard telecom de- 
vices. Note that this requirement, as a side ben- 
efit, may simplify security studies: we have learnt 
in the recent years that any optical component can 
be regarded as a "Trojan horse" because of its im- 
perfections [2]. 

• The security of the system must be guaranteed by 
quantum physics, thence in some way quantum co- 
herence must play a role. 

The goal of this paper is to illustrate this program by 
presenting such a system, the key is created in a data 
line that is probably the simplest one can think of — 
just measure the time of arrival of weak pulses. The 
intervention of a spy is checked interferometrically in a 
monitoring line. In Section II, we define precisely the 
protocol and stress its advantages. In Section III, we 
present a quantitative study of security. Finally, Section 



IV presents a number of possible variations on the main 
idea. 



II. THE PROTOCOL 





JP-9 
ilil 






Laser 


Var. att. 



9 



Alice 




Bob 



M2 



FIG. 1. Scheme of the protocol. Bob reads the raw key 
in detector Db, the monitoring line checks for the breaking 
of quantum coherence due to an eavesdropper. See text for 
details 



A. The source 

Alice uses a mode-locked laser, producing pulses of 
mean photon-number fj, that are separated by a fixed 
and well-defined time r; with a variable attenuator, she 
can blocks some of the pulses (note that a more econom- 
ical source would just consist of a cw laser followed by 
the variable attenuator). Each logical bit is encoded in a 
two-pulse sequence according to the following rules: 



(1) 
(2) 



For instance, the eight-pulse sequence drawn in Fig. 1 
codes for the four-bit string 0100 (read in temporal or- 
der, that is, from right to left). For small /i, the states 
\0a) and |1^) have a large overlap because of their vac- 
uum component. Since the laser is mode-locked, there 
is a phase coherence between any two non-empty pulses. 
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Leaving a more general discussion for Section IV, we fo- 
cus on the case where bit number A; is 1 and bit number 
fc + 1 is 0, like bits number 2 and 3 of 1. Then across the 
bit-separation there is a phase coherence: 

|VMe^(^^)^),JVMeWi)^)^^^^. (3) 

Note that the choice of the value of is arbitrary, so from 
now on we set (p = 0. 



B. The "data line" 

The pulses now propagate to Bob, on a quantum 
channel characterized by a transmission t = iQ-'^^/'^o 
(a typical value for a in optical fibers is 0.2 dB/km). 
Bob's setup first splits the pulses using a non-cquilibratcd 
beam-splitter with transmission coefficient ts- The 
pulses that are transmitted are used to establish the raw 
key {data line). To obtain the bit value, Bob has to dis- 
tinguish unambiguously between the two non-orthogonal 
states 



|0b) 



a 



2k- 



-i|0) 



2k 1 



\Ib) = m2k-lW)2k 



(4) 
(5) 



with a = y/ntts — we have omitted the phase due to 
the free propagation, which is the same for all pulses. 
As well-known, unambiguous discrimination between two 
pure states can succeed with probability pok = 1 — 
|(0b|1b)|; in the present case, the overlap is |(0b|1b)| = 
e~l"l , and consequently pok = 1 — e^^"^. Now, there 
is an obvious way to achieve this result: photon counting 
with a perfect detector, because Pok is just the probabil- 
ity that the detector will detect something. The realistic 
situation where the detector has a finite efficiency rj can 
be modelled by an additional beam-splitter with trans- 
mittivity rj followed by a perfect detector; in this case, i] 
appears in the exponent as well. In conclusion, the opti- 
mal unambiguous discrimination between |0b) and |1_b) 
is achieved by the most elementary strategy, simply try 
to detect where the photons are. Later, Bob must an- 
nounce Alice which items he has detected: this is how 
Alice and Bob establish their raw key. Note that no er- 
ror is expected on this line, if the switch is perfect and 
in the absence of dark counts of the detector: a bit-flip 
is impossible because it would correspond to a photon 
jumping from a time-bin to another. 

Note that the simplicity of Bob's data line has concrete 
practical advantages. There are no lossy and active ele- 
ments. Hence, the transmission range can be increased 
and no random number generator is needed. 

As for the data line, our protocol is similar to the one 
of Debuisschert and Boucher [3] . However there, the se- 
curity was obtained by the overlap in time between the 
pulses coding for different bits. Here, we use rather the 
monitoring line described in the next paragraph. 



C. The "monitoring line" 



The pulses that are reflected at Bob's beam-splitter 

go to an interferometer that is used for monitoring Eve's 
presence {monitoring line). Here is where quantum co- 
herence plays a role. Let aj be the amplitude of pulse j 
entering the interferometer: in particular, \aj\'^ is either 
or /zt (1 — ts)', and if both aj and a^+i are non-zero, 
then aj+i = aj. After the interferometer, the pulses that 
reach the detectors at time j -|- 1 is given by 



(6) 
(7) 



\Dmi) = 

\Dm2) = 

Now, if either aj or aj+i are zero, then |£>miP = 
|-DM2p = ^l^t{l — is); i.e., conditioned to the fact that 
a photon takes the monitoring line, the probabilities of 
detecting it in either detector is |. However, if both aj 



and Qfj+i are non-zero, then \D 

\D 



M2\ 



Mil = A^i (1 - ts) and 
= 0: only detector Dmi can fire. Consider then 
again the case where bit number fc is 1 and bit number 
fc -|- 1 is 0: as we said above, in this case the two consec- 
utive pulses 2k and 2 A: -I- 1 are non-empty. This means 
that, if coherence is not broken, detector Dm2 cannot fire 
at time 2fc -|- 1. If Eve happens to break the coherence by 
reading the channel, it could be detected this way. 

Actually, it turns out that, as just described, the pro- 
tocol is insecure: Eve can make a coherent measurement 
of the number of photons in the two pulses across the 
bit-separation. With such an attack, she would not break 
the coherence, thus introduce no errors in the monitoring 
line, and obtain almost full information (see next Section 
for more details). There are several ways of countering 
this attack: here, we make use of decoy sequences, in- 
spired by the idea of " decoy states" introduced by Hwang 
[4] and by Lo and co-workers [5], but different in its im- 
plementation. The principle is the following: with prob- 
ability /, Alice leaves both the {2k — l)-th and the 2fc-th 
pulses non-empty. A decoy sequence does not encode a 
bit value (in contrast to the decoy states of [4,5] that 
still encode a state, but in a different way) : thence, if the 
item is detected in the data line, it will be discarded in 
public discussion. However, if a detection takes place in 
the monitoring line at time 2k, then it must be in detec- 
tor Dim because of coherence. Now Eve can no longer 
pass unnoticed: if she attacks coherently across the bit 
separation, then she breaks the coherence of the decoy 
sequences; if she attacks coherently within each bit, then 
she breaks the coherence across the separation; finally, if 
she makes a coherent attack on a larger number of pulses, 
then she breaks the coherence in fewer positions but gets 
much less information. 
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Thus, errors arc rare: they appear only in the monitor- 
ing Una, and just for a fraction of the whole cases. Still, 
one can estimate the error (thence, the coherence of the 
channel) in a reasonable time, if the bit rate is high. 

D. Summary of the protocol 

Let's summarize the protocol before moving to a more 
quantitative study of security: 

1. AUce prepares "bit 0" with probability "bit 1" 

with probability and the decoy sequence with 
probability /. This is repeated a large number of 
times. 

2. At the end of the exchange, Alice reveals the items 
{fed} corresponding to a decoy sequence. Bob re- 
moves all the detections at times 2ki — 1 and 2ki 
from his raw key, and he looks whether detector 
Dim has ever fired at times Ikd- This way, Alice 
and Bob estimate the break of coherence of decoy 
pulses. 

3. On the remaining fraction of sent bits 1 — /, Bob 
reveals the times 2A; + 1 in which he had a detec- 
tion in D2M- Alice verifies if some of these items 
correspond to a bit sequence " 1,0" ; thus, Alice and 
Bob estimate the break of coherence across the bit- 
separation. 

4. Finally, Bob reveals the items that he has detected 
in the data line. Alice and Bob run error correction 
and privacy amplification on these bits and end up 
with a secret key. 

Should one say in one sentence where the improvement 
lies, here it is: one can define a very simple data line and 
protect it quantum-mechanically. 

At this point, two important remarks can be done. 
First, this protocol cannot be analyzed in terms of qubits. 
This is obvious, because any bits and coherence are 
checked on differently defined pairs. In particular, there 
is not a "natural" single-photon version of the proto- 
col (simply replace non-empty coherent state with one- 
photon Fock states would be dramatic, since all the se- 
quences would become orthogonal). The second remark 
is the answer to a possible question. With the idea of 
a simple data line for key creation, and a "complemen- 
tary" line for monitoring, one may implement a version 
of the BB84 protocol: Alice and Bob agree to produce 
the key using only the Z basis; sometimes Alice prepares 
one of the eigenstates of the X basis that acts as a de- 
coy state. Which are the advantages of our protocol? 
We are going to see that our protocol is much more ro- 
bust against attacks at zero errors (the analog of photon- 
number-splitting attacks). 



III. QUANTITATIVE ANALYSIS OF SECURITY 

For a reasonable comparison with experiment, we must 
introduce the following parameters 

• The visibility V of the monitoring interferometer, 
whence the probability that D2M fires in a time cor- 
responding to a coherence is instead of zero. 
We suppose that Eve can take advantage of these 
imperfections: for instance, if the reduced visibility 
is due to 99 7^ in the interferometer. Eve can sys- 
tematically correct for this error by displacing the 
pulses, and then reproduce V by adding errors in a 
way that is profitable for her. 

• The imperfections of the three Bob's detectors, sup- 
posed to be identical for simplicity: the quantum 
efficiency 77 and the probability per gate of a dark 
count pd- Typical values are r] = 10%, pd = 10^^. 
These imperfections are not given to Eve (see Sec- 
tion IV on the possibility that Eve forces a detec- 
tion, thus effectively setting 77 = 1 for some pulses). 

For simplicity in writing, we make all the quantita- 
tive analysis in the limit of small mean photon-number 
in Bob's channel, that is jit « 1. 



A. Parameters Alice-Bob on the data line 

First, we compute the parameters of Alice-Bob on the 
data line. Bob's detection rate in Db, once decoy se- 
quences are removed, is 

Rb = [fiT + (1 - f,T)pd\ (1 - /) (8) 

where T = tts V- In other words, Rb times the number 
of two-pulse sequences sent by Alice is the length of the 
raw key. 

If we assume that the switch prepares really empty 
pulses when it is closed, the error expected in this line is 
only due to the dark counts of the detectors: 

^^i(i-,r)p,(i-/) 

Rb 

because dark counts may make the detector fire at both 
times with equal probability. The mutual information 
Alice-Bob in bits per sent photon is thence 

I{A :B)=Rb[1- H{Q)] . (10) 

In what follows, we shall concentrate on attacks by Eve 
that do not modify Q. Before moving to that, let's have 
a look at the monitoring line as well. 
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B. About the monitoring line 

In the presence of dark counts and reduced visibility, 
the meaningful detection probabilities in Dmi and Dm2, 
neglecting double counts are the following [6]: 

Time 2fc, decoy seq. ■ Rf,2 = Rmi,2 f (H) 

Time 2k + 1, seq. "1,0" : RI% = i?i?i,2 (12) 

where, denoting T = t {1 — ts) f], we have defined 

RMi.2 = f^T — - — +(i-/ir — - — jpd. (13) 

Contrary to the errors due to dark counts, the departure 
from perfect visibility will be entirely attributed to Eve. 
This is why we consider a priori different values Vd and 
Vio for the visibility in the two cases: as we shall see. 
Eve's attacks may be different. 

C. Eve's attacks 

If Bob's detector has dark counts, I{B : E) is smaller 
than I{A : E) for a prepare-and-measure scheme, because 
even if Eve knows perfectly what Alice has sent, she can- 
not know whether Bob has detected a photon or has had a 
dark count. Thus in our case, the Csiszar-Korner bound 
[7] that gives an estimate of the extractable secret key 
rate becomes 

R>I{A:B)- min {l{A : E)J{B : E)} 

= I{A : B) - I{B : E) . (14) 

Therefore, we have to compute the mutual information 
Bob-Eve. 




FIG. 2. Scheme with Eve. 



The kind of attacks by Eve that we consider is sketched 
in Fig. 2. We can give Eve all the losses in the line, that 
is, we can suppose that Eve removes a fraction 1 — t of the 
photons, and forwards the remaining fraction t to Bob on 
a lossless line. We are going to study: 

• An attack in which Eve can gain information with- 
out introducing errors. This is related to the losses 
on the line; it is the analog of the usual photon- 
number-splitting attack [8,9], but is a different at- 
tack and less powerful. 



• Eve can immediately know if the previous attack 
was successful or not; in the case it wasn't, we con- 
sider further the possibility of attacks that intro- 
duce errors in the monitoring line (but still no er- 
rors in the data line) . Specifically, we study a usual 
intercept-resend strategy, and a more clever attack 
which is performed coherently on two subsequent 
pulses across the bit-separation. 



1. Eve's attack without errors 



In the case of BB84 and many other protocols. Eve can 
exploit multi-photon pulses in a lossy line to perform the 
photon-number- splitting attack [8,9]: she counts the pho- 
tons in each pulse, and whenever this number is larger 
than one, she keeps one photon in a quantum memory 
and forwards the remaining photons to Bob on a lossless 
line. As such, this attack is not error-free in the present 
protocol: counting the photons in each pulse breaks the 
coherence between successive pulses, thus introducing er- 
rors in the monitoring line — actually, because of the 
peculiar encoding of the bits, this attack reduces here to 
the intercept-resend, see below. 

More subtle is the analysis of a practical version of 
the attack using cascaded beam-splitters [10]: Eve uses a 
highly unbalanced BS, with transmission 1 — e and reflec- 
tion e; if she has a detection, she forwards the remaining 
photons to Bob; otherwise, she begins anew, and so on 
until the losses that she introduces reach the transmission 
t of the quantum channel. The advantage of this strategy 
is that, in the presence of two or more photons, it is very 
rare that more than one photon is coupled into Eve's de- 
tector. Indeed, this beam-splitting attack approximates 
a photon-counting. In our case, this strategy will intro- 
duce errors in the monitoring line as well: it does not 
modify the relative phase, but the relative intensity be- 
tween subsequent pulses, thus leading to an unbalancing 
of the interferometer. The full analysis of such a strategy 
will be studied in a further work. 

In summary, both the ideal photon-number-splitting 
and its approximate implementation through cascaded 
beam-splitters do not rank among the zero-error attacks 
against our protocol. In fact. Eve can only perform the 
basic beam- splitting attack: she removes a fraction 1 — t 
of the photons, and transmits the remaining fraction t 
to Bob on a lossless line. With the fraction that she has 
kept, the best thing Eve can do is just to measure them 
(recall the argument about optimal unambiguous state 
discrimination). This way, she detects /i(l — t) photons 
per pulse. When Eve has a detection in D^, she knows 
the bit that Alice has sent. Then she lets the remain- 
ing part of the pulse travel to Bob on the lossless line 
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(the grey box of Fig. 2 is simply a line). Bob detects 
something exactly as if Eve had not been there. So 

IiB:E\DE)=IiA:B). (15) 

In summary, Eve knows a fraction //(I — t) of the key just 
because of the losses in the quantum channel: this frac- 
tion must always be subtracted in privacy amplification. 

It is instructive to compute the optimal value of fi un- 
der the assumption that Eve introduces no errors, and 
neglecting dark counts {Q = 0). In BB84, this value is 
fJ-BBSi = t, giving RsBSi = jV't'^ [H]- Here, Alice and 
Bob must maximize R given in (14); using (10) and (15), 
this reads 

R = ^ittBvil-f){l-tiil-t)). (16) 
The optimization dR/d^j, = is readily done and yields 

= 2(1^ (^^^ 

whence 

Ropt^^^^ttBvil-f)- (18) 

This is an important improvement over BB84: iiopt is 
large and is basically constant with decreasing t (long 
quantum channels); as a consequence, the secret-key rate 
decreases only linearly (and not quadratically) with t. 
This is the same improvement that can be obtained by 
using decoy states [5] or a strong reference pulse [12]; 
note however that the hardware is much simpler here. 

When Eve's detector De does not fire, which happens 
with probability 1 — /i(l — t), Eve must perform some 
attack on the pulses flying to Bob if she wants to gain 
some information. These attacks will certainly introduce 
errors, either in the data line or in the monitoring line. In 
the following, we present two such attacks (Fig. 3): a ba- 
sic intercept- resend (I-R) , and a photon- number-counting 
attack performed coherently on two subsequent pulses 
across the bit-separation (2c-PNC). 



FIG. 3. Comparison of two attacks that introduce er- 
rors. In the I-R attack, Eve prepares a sequence of localized 
Fock states, thus breaking the coherence everywhere. In the 
2c-PNC attack. Eve prepares a sequence of Fock states that 
are delocalized across the separation of bits; only the coher- 
ence of decoy sequences is broken. Note that arrows denote 
only coherence between subsequent pulses, the one checked 
by the interferometer; however, on the original sequence, all 
the non-empty pulses are coherent with one another, while in 
the sequences after Eve's attack only the indicated coherence 
remains. 

2. Eve's attack with errors (I): intercept-resend 

Let's begin with the intercept-resend (I-R) strategy. 
Eve simply detects the pulse flying to Bob: her detector 
will flre with probability /^t, and in this case she prepares 
a single-photon in the good time-bin and forwards it to 
Bob. Obviously, both Rb and Q are unchanged under 
this strategy. 

Note that Rb will be the sum of three terms: Eve has 
detected and Bob detects too; Eve has detected and Bob 
has a dark count; Eve has not detected and Bob has a 
dark count. Now, Eve can distinguish the last one from 
the two flrst, and she knows that in the last case she has 
no information on Alice's and Bob's bits. So 

I{B : E\IR) = [Rb - (1 - /it)pd(l - /)] [l - H{Q')\ (19) 

where 

Q' = ^^V^'^^^t (20) 
tBrj + (1 - tBri)pd 

is the fraction of Bob's detection on which she has the 
wrong result. 

Of course, the I-R attack breaks all the coherences (see 
Fig. 3), and will therefore introduce errors in the moni- 
toring line. Speciflcally, whenever Eve has performed the 
I-R attack, 

Kz|/fl = ^io|/i?, = 0. (21) 



3. Eve's attack with errors (II): 2-coherent PNC 



Eve I-R 

Eve 

2C-PNC 



Alice iiin ihi iii 



In the absence of decoy sequences, Eve may obtain in- 
formation without introducing errors in the monitoring 
line, by counting the number of photons coherently be- 
tween two pulses, not within each bit but across the sep- 
aration line (see Fig. 3). This attack does not break the 
phase between these pulses. Of course, if Eve finds n > 
photons, on the spot she does not know to which bit the 
photon belongs; but she will learn it later, by listening 
to Bob's list of accepted bits [13]. Actually, in some very 
rare case Eve still does not get any information: if Eve 



5 



prepares n > photons in two successive two-pulse se- 
quences, and Bob accepts a detection in the bit common 
to both sequences, Eve has no idea of his result. How- 
ever, since such cases arc rare, wc make the conservative 
assumption that Eve always gets full information. Thus 

I{B : E\2cPNC) = I{B : E\IR) . (22) 

Eve has introduced errors in the monitoring line only in 
the items corresponding to decoy sequences: 

^d|2c = 0, Fio|2c = l- (23) 

4- Collecting everything 

We can now collect all that we know form this analy- 
sis of security. The parameters describing Alice and Bob 
are those listed in paragraph III A above. Let piR and 
P2c be the probabilities that Eve performs the I-R at- 
tack, resp. the 2c-PNC attack. Recall that she performs 
these attacks only when her detector De did not fire, so 
PiR+P2c< Then: 

I{B : E) = nil - t) Rb [1 - HiQ)] + 

+ ipiR+P2c)R'B[^~H{Q')] (24) 

with the notation R'g = Rb — (1 — fJ,t)pd{i — ,f) and with 
Q' given in (20). This is the expression that must be in- 
serted into (14) to obtain the extractable secret key rate 
(in other terms, this is the quantity to be corrected by 
privacy amplification). 

On the monitoring line, Alice and Bob measure (11) 
and (12). whence they extract Vd and Vio that inform 
them about Eve's attacks according to 

Vd = l- piR - P2c , (25) 
Vio = l~ PIR . (26) 

Note in particular that, if Alice and Bob find Va = Vio, 
they can conclude that Eve has not used the 2c-PNC at- 
tack by the way, this is why we presented the analysis 
of the I-R strategy, obviously worse than 2c-PNC from 
Eve's standpoint: in a practical experiment, Vd = Vio is 
very likely to hold (after all. Eve is not there...). There- 
fore, formulae for the I-R attack will be useful in the 
analysis of experimental data. 

IV. VARIATIONS AND OPEN QUESTIONS 

A. Variations 

Here are a few ideas of variations in the protocol, that 
may have some additional benefit and require further 
study: 



• Alice may change diiring the protocol the defini- 
tion of the pulses that define a bit. If there is 
a convenient fraction of decoy sequences. Eve has 
no way of distinguishing a priori which pairs of 
successive pulses encode a bit. This way, the ef- 
fect of the 2c-PNC attack becomes equally dis- 
tributed among decoy and "1,0" sequences, i.e. 
Vd = ViQ = 1 — piR — \p2c- Moreover, whenever 
Eve attacks the bit instead of attacking across the 
bit-separation, she cannot gain any information. 

• In fact, nothing forces to define bits by subsequent 
pulses: Alice and Bob can decide later, adding a 
sort of "sifting" phase to the protocol. This means 
that Alice can now send whatever pulse sequence, 
she is no longer restricted to those that define a 
bit or a decoy sequence. It is not clear whether 
this modification helps, if the hardware is kept un- 
changed: Alice and Bob still check only the coher- 
ence between subsequent pulses; moreover, sifting 
means additional losses and additional information 
revealed publicly. 

• Instead of introducing decoy sequences as wc did 
above, one may study the effect of decoy pulses with 
different intensities, as proposed by Hwang and by 
Lo and co-workers to protect the BB84 protocol 
against the photon- number-splitting attack [4,5]. 

B. Possible loopholes 

The difficulty in assessing the security of practical 
QKD, is the huge number of imperfections that may hide 
loopholes for security. These imperfections exist in all im- 
plementations and for all protocols, but their effect and 
the corresponding protection may vary. Here we present 
some of these. 

• About Trojan- horse and similar realistic attacks [2]: 
Alice's setup must be protected against Trojan- 
horse attacks, with the suitable filters, isolators 
etc. In Bob's setup nothing is variable; however, 
one must prevent the possible light emission from 
avalanche photodiodes to become available to Eve: 
if the firing of a detector can be seen from outside 
Bob, the protocol becomes immediately insecure. 

• After a detection, Bob's detectors are blind during 
some time. In particular, if Eve happens to know 
when Bob's detector Dm2 has fired, she can attack 
strongly the subsequent pulses because no error will 
be detected then, and gain one bit (just one, be- 
cause when Db has fired, then it has a dead time 
as well). For the security of the protocol, Eve must 
have no way of assessing the firing of a detector, 
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and Bob must announce publicly this information 
only after the detector is ready again. This may im- 
ply some suitable synchronization in the software, 
or more simply, to shut Db &s long as Dm2 has not 
recovered. The nuisance depends of course on the 
ratio between the raw bit rate and the dead time. 

• In all this paper, we have considered only the case 
where Eve does not change Bob's detection rates 
in the data line and in the monitoring lino. By 
sending out stronger pulses. Eve might force the 
detection of those items on which she has full in- 
formation; but in turn, she would increase the rate 
of double counts among Bob's detectors. This ef- 
fect must be quantified, and the number of double, 
or even triple, counts must be monitored during the 
experiment. 



V. CONCLUSION 

In conclusion, we have presented a new protocol for 
quantum cryptography whose realization is much sim- 
pler than that of previously described ones. Specifically, 
Bob's station is such that losses are minimized and no 
dynamical component is needed. 

We thank H.-K. Lo for stimulating comments. We ac- 
knowledge financial support from idQuantique and from 
the Swiss NCCR " Quantum photonics" . 
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